MMD
43e317eeba
- Delete backups/*.dump and all real credentials from README/docs
(prod MinIO creds, Casdoor passwords, server IP, admin password)
- All stack secrets now come from git-ignored .env (.env.example added);
docker-compose.prod.yml refuses to boot without them (${VAR:?})
- seed_casdoor.py: bcrypt password hashing, generated console/client secrets
- Harden infra/deploy-webhook: HMAC-verified Gitea webhook receiver
+ systemd unit + README (replaces unauthenticated deploy endpoint)
- docs/SECRET-MANAGEMENT.md: secret inventory + rotation checklist
38 lines
1.2 KiB
YAML
38 lines
1.2 KiB
YAML
# Traefik dynamic config (file provider) — shared middlewares.
|
|
# The HTTP→HTTPS redirect is attached from docker-compose.prod.yml so that
|
|
# local development (http://localhost) keeps working without TLS.
|
|
http:
|
|
middlewares:
|
|
redirect-https:
|
|
redirectScheme:
|
|
scheme: https
|
|
permanent: true
|
|
|
|
# Baseline security headers for every public router (attached in the
|
|
# prod overlay; local http://localhost stays untouched).
|
|
secure-headers:
|
|
headers:
|
|
stsSeconds: 31536000
|
|
stsIncludeSubdomains: true
|
|
contentTypeNosniff: true
|
|
referrerPolicy: strict-origin-when-cross-origin
|
|
customFrameOptionsValue: DENY
|
|
browserXssFilter: true
|
|
customResponseHeaders:
|
|
X-Powered-By: ""
|
|
Server: ""
|
|
|
|
# Edge rate limiting — coarse abuse brake for the API host
|
|
# (average 50 req/s sustained, burst 150). Fine-grained login limiting
|
|
# lives in the app (slowapi).
|
|
api-ratelimit:
|
|
rateLimit:
|
|
average: 50
|
|
burst: 150
|
|
|
|
# Cap request bodies at the edge (attachments are ≤5 MB per file;
|
|
# 12 MB leaves room for multipart overhead).
|
|
api-bodylimit:
|
|
buffering:
|
|
maxRequestBodyBytes: 12582912
|